Analysis
-
max time kernel
216s -
max time network
222s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
30/09/2023, 19:31
General
-
Target
Nova pasta/Process_Hacker_-_Undetected.exe
-
Size
10.1MB
-
MD5
38aaf0d0974dabea141bb993cd4042e2
-
SHA1
7c13b69fb7c3bcce41c3f4bf425966eec987c017
-
SHA256
42ae95cd0808c7221b8a80cc4fc01c69cceac2b72a6eed95e2c04d563be55a56
-
SHA512
e80c046e0413b3a8ec748e44452833d2ce9de0b22a95dbaac5ffb4552af922f539a65ce3b6430c303913814a718835cfdeed5d49b4cd831984b1f5c6c7beaedb
-
SSDEEP
196608:jc9vfisVBb9mvOa3IzRvTj7GGnplRfq0aC2b/9MOE4JFnAzfAFlJ80NntBna2BYI:I9vfRetO37GGnpzfACfQnAzw/va2Xt
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
AutoIT Executable 5 IoCs
AutoIT scripts compiled to PE executables.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 25 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Modifies system certificate store 2 TTPs 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nova pasta\Process_Hacker_-_Undetected.exe"C:\Users\Admin\AppData\Local\Temp\Nova pasta\Process_Hacker_-_Undetected.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Nova pasta\ph.dat"C:\Users\Admin\AppData\Local\Temp\Nova pasta\ph.dat"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\evbCA56.tmp"C:\Users\Admin\AppData\Local\Temp\Nova pasta\87675643324.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14B
MD533c7088a69d5b0df397408286608762a
SHA1c2d9477d58549d2c3e60f469f49d3f6d0b1b1a41
SHA2561e94329a83b6ebccc85020c37797422a416d1b459c04fd256a6e05a45093fca9
SHA5127ceac70bf1d06ba1eab310f8958026a19c0a4b76fdacc1843481e9c43d5e7016580d00e262a2a7de3fd18b22c628ca39cac18a15949ad85ae72237f0d818c4d7
-
Filesize
7.2MB
MD54a0a94325f1a9b6274638d8c59978357
SHA110c568775f333c6ce5ac598696c91e9c22c40292
SHA256e73c3125b302479216e5519456fabffabc5120287ef1cabc3b05b1a6dc9f9187
SHA5120e8022487ec79c689ee26eb1aae205407bdb16cb54c8ce26b0a532fc8718c8a40e7df8ea75757ab000aac2d64854bb9fb0bc9b090caf06f3a97d9144c1001611
-
Filesize
1KB
MD57656680b3a8f608a25173e28875348cc
SHA19d5e137f66663cbc4ca54d52d7ff0db039e6b9ea
SHA256f628da7fdab49d4f3a6789f1536a24de17bfb6f38d7a54f164bd1cb41e464d07
SHA51249111b57082b6889c55f264056f6bb0dd78dd880e93fce3bb6acc35dab59eba41a13c3666f6a2400c566b9985472e4d55e9b0571401216152e33150eafc34bb7
-
Filesize
1KB
MD57656680b3a8f608a25173e28875348cc
SHA19d5e137f66663cbc4ca54d52d7ff0db039e6b9ea
SHA256f628da7fdab49d4f3a6789f1536a24de17bfb6f38d7a54f164bd1cb41e464d07
SHA51249111b57082b6889c55f264056f6bb0dd78dd880e93fce3bb6acc35dab59eba41a13c3666f6a2400c566b9985472e4d55e9b0571401216152e33150eafc34bb7
-
Filesize
32B
MD57820b6b8eb5bfbdcaeb419a65a402c6c
SHA137ab0bf2dcccfba042e85ac3ae5aae0b7d317753
SHA2562f304a7cff0f71068da2a4b05f7369a455161f0fbfe479ef57180b14d83bde37
SHA51203c0eca2fa6b024130331942147e8b188fc830fcf3cca9ebb81698f39e6d3220e4625d20c2eeac0874de3655abd35cae2c367a37c2dd7594717b688bc12b7c0a
-
Filesize
14B
MD533c7088a69d5b0df397408286608762a
SHA1c2d9477d58549d2c3e60f469f49d3f6d0b1b1a41
SHA2561e94329a83b6ebccc85020c37797422a416d1b459c04fd256a6e05a45093fca9
SHA5127ceac70bf1d06ba1eab310f8958026a19c0a4b76fdacc1843481e9c43d5e7016580d00e262a2a7de3fd18b22c628ca39cac18a15949ad85ae72237f0d818c4d7
-
Filesize
14B
MD533c7088a69d5b0df397408286608762a
SHA1c2d9477d58549d2c3e60f469f49d3f6d0b1b1a41
SHA2561e94329a83b6ebccc85020c37797422a416d1b459c04fd256a6e05a45093fca9
SHA5127ceac70bf1d06ba1eab310f8958026a19c0a4b76fdacc1843481e9c43d5e7016580d00e262a2a7de3fd18b22c628ca39cac18a15949ad85ae72237f0d818c4d7
-
Filesize
7.2MB
MD54a0a94325f1a9b6274638d8c59978357
SHA110c568775f333c6ce5ac598696c91e9c22c40292
SHA256e73c3125b302479216e5519456fabffabc5120287ef1cabc3b05b1a6dc9f9187
SHA5120e8022487ec79c689ee26eb1aae205407bdb16cb54c8ce26b0a532fc8718c8a40e7df8ea75757ab000aac2d64854bb9fb0bc9b090caf06f3a97d9144c1001611
-
Filesize
32B
MD57820b6b8eb5bfbdcaeb419a65a402c6c
SHA137ab0bf2dcccfba042e85ac3ae5aae0b7d317753
SHA2562f304a7cff0f71068da2a4b05f7369a455161f0fbfe479ef57180b14d83bde37
SHA51203c0eca2fa6b024130331942147e8b188fc830fcf3cca9ebb81698f39e6d3220e4625d20c2eeac0874de3655abd35cae2c367a37c2dd7594717b688bc12b7c0a
-
Filesize
32B
MD57820b6b8eb5bfbdcaeb419a65a402c6c
SHA137ab0bf2dcccfba042e85ac3ae5aae0b7d317753
SHA2562f304a7cff0f71068da2a4b05f7369a455161f0fbfe479ef57180b14d83bde37
SHA51203c0eca2fa6b024130331942147e8b188fc830fcf3cca9ebb81698f39e6d3220e4625d20c2eeac0874de3655abd35cae2c367a37c2dd7594717b688bc12b7c0a
-
Filesize
4KB
-
Filesize
3.8MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
4KB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
64KB
-
Filesize
16.4MB
-
Filesize
4KB
-
Filesize
16.4MB
-
Filesize
988KB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
3.8MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
988KB
-
Filesize
16.4MB
-
Filesize
2.0MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
2.0MB
-
Filesize
13.7MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
13.7MB
-
Filesize
13.7MB
-
Filesize
13.7MB
-
Filesize
13.7MB
-
Filesize
2.0MB
-
Filesize
13.7MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
3.8MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB